Devices grouped by where they physically sit. Lines are grants — directed: the source initiates, the target never answers back.
This is a demo. Every device, user, site and network below is invented — but it is rendered by the real code, not mocked up. Source and setup: github.com/crazyhoesl/tailnet-atlas
23 nodes. Placement follows the address a device was last given by the network it joined — for the travel routers that is their uplink, not the LAN they serve.
| Device | Tailscale IP | Local · site | OS | Roles |
|---|---|---|---|---|
| atlas | 100.82.62.24 | 172.25.0.3 ·dock | linux | server |
| backups | 100.81.53.21 | 172.22.0.2 ·dock | linux | server |
| cloud-exit | 100.82.77.29 | 10.0.19.7 ·mobile | linux | exitupdate available |
| crate | 100.80.14.8 | 192.168.10.30 ·lisbon | linux | server |
| doorbell-relay | 100.82.59.23 | 172.24.0.3 ·dock | linux | ha-access |
| hub | 100.80.11.7 | 192.168.10.20 ·lisbon | linux | exithomeserversubnet192.168.10.0/24 |
| kitchen-tablet offline | 100.80.26.12 | 192.168.10.52 ·lisbon | android | clientha-access |
| living-room-tv | 100.80.23.11 | 192.168.10.51 ·lisbon | android | clientupdate available |
| metrics | 100.81.50.20 | 172.21.0.2 ·dock | linux | serverupdate available |
| mila-ipad offline | 100.82.74.28 | 172.20.10.4 ·mobile | ios | clientha-accessuser: mila |
| mila-laptop | 100.81.41.17 | 10.20.30.44 ·berlin | windows | client-fulluser: mila |
| nadia-pixel | 100.80.20.10 | 192.168.10.42 ·lisbon | android | client-full |
| notes | 100.81.47.19 | 172.19.0.3 ·dock | linux | server |
| office-nuc | 100.81.35.15 | 10.20.30.2 ·berlin | linux | exitserversubnet10.20.30.0/24user: mila |
| photos | 100.81.44.18 | 172.19.0.2 ·dock | linux | server |
| plotter | 100.81.38.16 | 10.20.30.31 ·berlin | linux | clientuser: mila |
| recipes | 100.81.56.22 | 172.23.0.2 ·dock | linux | ha-accessserver |
| theo-iphone | 100.80.29.13 | 192.168.10.53 ·lisbon | ios | clientha-accessuser: theo |
| theo-macbook | 100.80.32.14 | 192.168.10.54 ·lisbon | macos | client-fulluser: theo |
| thinkpad-x1 | 100.80.17.9 | 192.168.10.41 ·lisbon | linux | client-full |
| trip-router offline | 100.82.71.27 | 172.20.10.6 ·mobile | linux | exitserversubnet192.168.9.0/24 |
| van-router | 100.82.68.26 | 10.44.2.87 ·mobile | linux | exitserversubnet192.168.8.0/24 |
| wiki | 100.82.65.25 | 172.26.0.2 ·dock | linux | server |
Directed rules from the live policy file. Anything not listed here is denied.
| # | Source | Target | Ports | Edges drawn |
|---|---|---|---|---|
| 1 | client-full | server · home | any | 48 |
| 2 | client | home | 443 8123 | 5 |
| 3 | ha-access | home | 8123 | 5 |
| 4 | server | home | 514 | 11 |
Physical grouping. Containers share their host's uplink, so they form their own cluster.
| Site | Network | Devices | Roles present |
|---|---|---|---|
| Lisbon · home | 192.168.10.0/24 | 8 | clientfullhomeserver |
| Berlin · office | 10.20.30.0/24 | 3 | clientfullserver |
| Mobile · roaming | phones · travel routers | 4 | clientexitserver |
| Docker @ crate | 172.16/12 bridges | 8 | proxyserver |
Who a device belongs to. Access itself is granted by tag, never by person — ownership decides who can remove or re-authorise a node. On the map a device owned by someone else carries a solid outer ring, one owned by its tag a dashed one; unmarked nodes belong to the tailnet owner.
| Owner | Role | Online | Sites | Devices |
|---|---|---|---|---|
| nadia nadia@github | owner | 12/14 | Docker @ crate Lisbon · home Mobile · roaming | backups cloud-exit crate hub kitchen-tablet living-room-tv metrics nadia-pixel notes photos thinkpad-x1 trip-router van-router wiki |
| mila mila@github | member | 3/4 | Berlin · office Mobile · roaming | mila-ipad mila-laptop office-nuc plotter |
| theo theo@github | member | 2/2 | Lisbon · home | theo-iphone theo-macbook |
| tag-owned | tag-owned | 3/3 | Docker @ crate | atlas doorbell-relay recipes |
Nothing here is hand-assigned — every device is re-located on each refresh.
| Step | Rule | Why |
|---|---|---|
| 1. Collect | Take every private address the device was last seen on (10.x, 172.16-31.x, 192.168.x). | Tailscale reports all interfaces, not just the useful one. |
| 2. Drop self-hosted | Ignore any address ending in .1 — the gateway of a network the device hands out itself. | Travel routers carry their own LAN everywhere; it says nothing about location. Same for Docker bridges. |
| 3. Match a place | 192.168.10.x → Lisbon · home 10.20.30.x → Berlin · office 172.20.10.x → Mobile · roaming | Only networks bound to a physical location count. The hotspot range is listed so it is not mistaken for a Docker bridge — both sit inside 172.16/12. |
| 4. Docker | Anything left inside 172.16/12 joins the Docker @ crate cluster. | Containers share the host's netns and have no LAN of their own. |
| 5. Otherwise | Mobile · roaming. | Mobile data, a hotspot or an unknown network — the device is not at any known site. |
| 6. Pinned | cloud-exit always counts as roaming. | A datacenter VM has no LAN that would place it anywhere meaningful. |
Rules are rendered from the same constants the placement code uses, so this table cannot fall out of sync. A device that is offline keeps its last known address, and therefore its last known site, until it checks in again.
5 min
While this page is open it polls every 10s, for up to 5 min of viewing time
Read-only · status at /healthz